The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

322

Chapter 9 

■

Injecting Code

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 322

---

Figure 9-8: An email header injection attack

This causes the 

mail()

command to generate the following message:

To: [e-mail]

From: [e-mail]

Bcc: [e-mail]

Subject: Site problem

Confirm Order page doesn’t load

SMTP Command Injection

In other cases, the application may perform the SMTP conversation itself, or

may pass user-supplied input to a different component in order to do this. In

this situation, it may be possible to inject arbitrary SMTP commands directly

into this conversation, potentially taking full control of the messages being

generated by the application.

For example, consider an application that uses requests of the following

form to submit site feedback:

POST feedback.php HTTP/1.1

Host: wahh-app.com

Content-Length: 56

From=[e-mail]&Subject=Site+feedback&Message=foo

This causes the web application to perform an SMTP conversation with the

following commands:

MAIL FROM: [e-mail]

RCPT TO: [e-mail]

DATA 

From: [e-mail]

To: [e-mail]

Subject: Site feedback

foo

.